Microsoft Security Advisory 956391

Update Rollup for ActiveX Kill Bits

Published: October 14, 2008 | Updated: June 17, 2009

Version: 1.3

Microsoft is releasing a new set of ActiveX kill bits with this advisory. The class identifiers (CLSIDs) for these ActiveX controls are as listed in the Frequently Asked Questions section of this advisory.

This update sets the kill bits for the following third-party software:

Microgaming Download Helper. Microgaming has issued an advisory and an update that addresses vulnerabilities. Please see the advisory from Microgaming for more information. This kill bit is being set at the request of the owner of the ActiveX control. Customers who require support should contact Microgaming. The class identifiers (CLSIDs) for this ActiveX control are as listed in the Frequently Asked Questions section of this advisory.

System Requirements Lab. Husdawg has issued an advisory and an update that addresses a vulnerability. Please see the advisory from Husdawg for more information. This kill bit is being set at the request of the owner of the ActiveX control. Customers who require support should contact Husdawg. The class identifiers (CLSIDs) for this ActiveX control are as listed in the Frequently Asked Questions section of this advisory.

PhotoStockPlus Uploader Tool. PhotoStockPlus has issued an advisory on a vulnerable control. Please see the advisory from PhotoStockPlus for more information. This kill bit is being set at the request of the owner of the ActiveX control. Customers who require support should contact PhotoStockPlus. The class identifiers (CLSIDs) for this ActiveX control are as listed in the Frequently Asked Questions section of this advisory.

This update sets the kill bits for ActiveX controls addressed in previous Microsoft Security Bulletins. These kill bits are being set in this update as a defense in depth measure:

Do users with a Windows Server 2008 Server Core installation need to install this update?Users with a Windows Server 2008 Server Core installation will be offered this update, but do not need to install it. For more information on the Server Core installation option, see Server Core. Note that the Server Core installation option does not apply to certain editions of Windows Server 2008; see Compare Server Core Installation Options.

When applying this update, the RSClientPrint ActiveX Control stops working. How do I address this issue?Users who have installed this update and are printing reports from a web site that embeds the Microsoft Report Viewer Redistributable will not be able to print until they upgrade their servers to the latest version of the Microsoft Report Viewer Redistributable. The updates for the Microsoft Report Viewer Redistributable are available in MS08-052. Users who have installed this update and are printing reports from a Microsoft SharePoint site with the Microsoft SQL Server 2005 Reporting Services Add-in for Microsoft SharePoint Technologies installed will not be able to print until they upgrade their SharePoint servers to the latest version of Microsoft SQL Server 2005 Reporting Services Add-in for Microsoft SharePoint Technologies. The required update is available from the Microsoft Download Center.

Does this update replace the Cumulative Security Update of ActiveX Kill Bits (950760)?No, for the purpose of automatic updating, this update does not replace the Cumulative Security Update of ActiveX Kill Bits (950760) that is described in Microsoft Security Bulletin MS08-032. Automatic updating will still offer the MS08-032 update to customers regardless of whether or not they installed this update (956391). However, customers who install this update (956391) do not need to install the MS08-032 update to be protected with all the kill bits set in MS08-032.

Why is Microsoft releasing this Update Rollup for ActiveX Kill Bits with a security advisory when previous kill bit updates were released with a security bulletin?Microsoft is releasing this Update Rollup for ActiveX Kill Bits with an advisory because the new kill bits either do not affect Microsoft software, or had been previously set in a Microsoft Security Bulletin.

Why does this advisory not have a security rating associated with it?This update contains kill bits for third-party controls or controls that have previously been addressed in security updates. Microsoft does not provide a security rating for vulnerable third-party controls.

Does this update contain kill bits that were previously released in an Update Rollup for ActiveX Kill Bits?Yes, this update also includes kill bits that were previously set in Microsoft Security Advisory 953839.

Does this update contain kill bits that were previously shipped in an Internet Explorer security update?No, this update does not include kill bits that were previously shipped in an Internet Explorer security update. We recommend that you install the latest Cumulative Security Update for Internet Explorer.

What is a kill bit?A security feature in Microsoft Internet Explorer makes it possible to prevent an ActiveX control from ever being loaded by the Internet Explorer HTML-rendering engine. This is done by making a registry setting and is referred to as setting the kill bit. After the kill bit is set, the control can never be loaded, even when it is fully installed. Setting the kill bit makes sure that even if a vulnerable component is introduced or is re-introduced to a system, it remains inert and harmless.

What is a security update of ActiveX kill bits?This security update only contains the class IDs (CLSID) of certain ActiveX controls that are the basis of this security update.

Why does this update not contain any binary files?This update only makes changes to the registry to disable the control from instantiating in Internet Explorer.

Should I install this update if I do not have the affected component installed or use the affected platform?Yes. Installing this update will block the vulnerable control from running in Internet Explorer.

Do I need to reapply this update if I install an ActiveX control discussed in this security update at a later date?No, reapplying this update is not required. The kill bit will block Internet Explorer from running the control even if the control is installed at a later date.

What does this update do?This update sets the kill bit for a list of Class Identifiers (CLSIDs).

The following Class Identifier relates to a request by Microgaming to set the kill bit for an ActiveX control that is vulnerable. Further details can be found in the advisory issued by Microgaming:

Class Identifier

{AED98630-0251-4E83-917D-43A23D66D507}

The following Class Identifier relates to a request by Husdawg to set the kill bit for an ActiveX control that is vulnerable. Further details can be found in the advisory issued by Husdawg:

Class Identifier

{67A5F8DC-1A4B-4D66-9F24-A704AD929EEE}

The following Class Identifier relates to a request by PhotoStockPlus to set the kill bit for an ActiveX control that is vulnerable. Further details can be found in the advisory issued by PhotoStockPlus:

Class Identifier

{E48BB416-C578-4A62-84C9-5E3389ABE5FC}

The following Class Identifiers relate to Microsoft Security Bulletins MS02-044, MS08-017, MS08-041, and MS08-052 that have previously been addressed. These kill bits are being set as a Defense in Depth.

Workarounds

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

Prevent COM objects from running in Internet Explorer

You can disable attempts to instantiate a COM object in Internet Explorer by setting the kill bit for the control in the registry.

Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

For detailed steps that you can use to prevent a control from running in Internet Explorer, see Microsoft Knowledge Base Article 240797. Follow the steps in this article to create a Compatibility Flags value in the registry to prevent a COM object from being instantiated in Internet Explorer.

Note The Class Identifiers and corresponding files where the ActiveX objects are contained are documented under "What does this update do?" in the FAQ section above. Replace {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} below with the Class Identifiers found in this section.

To set the kill bit for a CLSID with a value of {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}, paste the following text in a text editor such as Notepad. Then, save the file by using the .reg file name extension.

You can apply this .reg file to individual systems by double-clicking it. You can also apply it across domains by using Group Policy. For more information about Group Policy, visit the following Microsoft Web sites:

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions:

V1.0 (October 14, 2008): Advisory published

V1.1 (October 29, 2008): Added Frequently Asked Questions entry to communicate the availability of an update for a control for which the kill bit was set.

V1.2 (November 12, 2008): Removed an incorrect reference that Windows Server 2008 Server Core installation is affected. Added an entry to Frequently Asked Questions to communicate that users with Windows Server 2008 Server Core installation will still be offered but do not need to install this update.

V1.3 (June 17, 2009): Added an entry to Frequently Asked Questions to communicate that for the purpose of automatic updating, this update does not replace the Cumulative Security Update of ActiveX Kill Bits (950760) that is described in Microsoft Security Bulletin MS08-032.